1 | #!/usr/bin/env python |
---|
2 | |
---|
3 | import sys, os |
---|
4 | import subprocess, tempfile |
---|
5 | import os.path |
---|
6 | import re |
---|
7 | |
---|
8 | from M2Crypto import X509 |
---|
9 | |
---|
10 | from string import join |
---|
11 | from federation.util import abac_pem_type, abac_split_cert, file_expanding_opts |
---|
12 | |
---|
13 | class Parser(file_expanding_opts): |
---|
14 | def __init__(self): |
---|
15 | file_expanding_opts.__init__(self, usage='%prog [options]') |
---|
16 | self.add_option('--out', dest='out', help='destination file', |
---|
17 | action='callback', callback=self.expand_file, type='str', |
---|
18 | default='./cert.pem') |
---|
19 | self.add_option('--debug', dest='debug', action='store_true', |
---|
20 | default=False, help='Just print command') |
---|
21 | self.add_option('--cert', dest='cert', |
---|
22 | help='Cretificate to copy subject from') |
---|
23 | self.add_option('--cn', dest='cn', default=None, |
---|
24 | help='Set the CN directly') |
---|
25 | self.add_option('--openssl', dest='openssl', |
---|
26 | help='Path to openssl command', default='/usr/bin/openssl') |
---|
27 | |
---|
28 | parser = Parser() |
---|
29 | opts, args = parser.parse_args() |
---|
30 | delete_key = False |
---|
31 | |
---|
32 | if args: |
---|
33 | key = args[0] |
---|
34 | else: |
---|
35 | sys.exit('Expecting a key as a non-optioned argument') |
---|
36 | |
---|
37 | ktype = abac_pem_type(key) |
---|
38 | if ktype == 'both': |
---|
39 | key, cert = abac_split_cert(key) |
---|
40 | os.unlink(cert) |
---|
41 | delete_key = True |
---|
42 | elif ktype != 'key': |
---|
43 | sys.exit('Cannot use %s as identity. It is a %s ' % (key, ktype) + |
---|
44 | 'and we were expecting a key') |
---|
45 | |
---|
46 | |
---|
47 | try: |
---|
48 | if opts.cn is not None: |
---|
49 | subj = '/CN=' + opts.cn |
---|
50 | if len(subj) > 64: subj = subj[0:63] |
---|
51 | else: |
---|
52 | c = X509.load_cert(opts.cert) |
---|
53 | subj = c.get_subject().as_text() |
---|
54 | if subj.startswith('/'): i = 1 |
---|
55 | else: i = 0 |
---|
56 | subj = '/' + re.sub('/', '\/', subj[i:]) |
---|
57 | |
---|
58 | tf, tn = tempfile.mkstemp(suffix=".pem") |
---|
59 | cmd = [opts.openssl, 'req', '-new', '-nodes', '-subj', |
---|
60 | subj, '-x509', '-days', '3650', |
---|
61 | '-key', key, '-out', tn] |
---|
62 | if opts.debug: |
---|
63 | print join(cmd) |
---|
64 | sys.exit(0) |
---|
65 | else: |
---|
66 | rv = subprocess.call(cmd) |
---|
67 | if rv == 0: |
---|
68 | try: |
---|
69 | of = os.fdopen(os.open(opts.out, |
---|
70 | os.O_WRONLY | os.O_CREAT, 0600), 'w') |
---|
71 | for inf in (tn, key): |
---|
72 | f = open(inf, 'r') |
---|
73 | for line in f: |
---|
74 | print >>of, line, |
---|
75 | f.close() |
---|
76 | of.close() |
---|
77 | except EnvironmentError, e: |
---|
78 | sys.exit("Cannot open %s: %s" % (efilename, e.strerror)) |
---|
79 | else: |
---|
80 | sys.exit("%s failed: %d" % (opts.openssl, rv)) |
---|
81 | finally: |
---|
82 | if delete_key and key: os.unlink(key) |
---|